Feeds

Dell does factory fresh virus infections?

Something new to be frightened about!

  • alert
  • submit to reddit

The essential guide to IT transformation

How the hell does a virus-infected set of motherboards find their way into the supply chain of a major system vendor? The vendor delivering the bad boards was Dell, and they’re blaming a slipshod supplier and ‘human error’. Yeah – human error. You can read all about it here and here.

The virus in question was a variant of an easily disinfected worm that was festering in the flash memory on the boards. Dell has removed all of the motherboards from their supply chain and rushed replacements to affected customers. That’s good, but it doesn’t make the fact that this happened in the first place any less deplorable.

To me, this situation brings up a range of disturbing scenarios. First, it proves that malware and other nasty, hidden code can be embedded in factory-fresh products and delivered to unsuspecting customers. This is akin to finding a pile of steaming dog crap when you unwrap your Quarter Pounder. Actually, it’s worse than that – the dog pile is pretty easy to detect in most (but not all) takeout dishes and, while certainly disturbing, you probably won’t end up eating it. A virus or Trojan is different.

It’s fortunate that the virus used was easy to detect. What concerns me is that there are vastly more insidious things that can be done along these lines. Why couldn’t some super-villain plant code in a new system that would lie low until a certain set of conditions are met?

For example: it’s dormant until a particular USB key is inserted into the machine; then it comes to life and opens up all sorts of back doors to the system. This same super-villain would have a low-level minion physically inside the data center with instructions to put the key into server x, wait a few minutes, and then pull the key out. Then the minion would casually walk out the door with gigabytes of confidential data and a big, big smirk.

Admittedly, this wouldn’t be easy to pull off. The bad guy would have to make sure that a particular component lands in the right data center, and that he has an insider in position to execute the plan. (The bad guy or bad gal, that is; I want to be fair, and women can be very evil in their own right.)

But how hard would it be if you had a lot of money behind you – or the resources of an entire government (even a small one)? The targets of these types of schemes won’t be confined to top-secret defense labs; there are plenty of juicy databases in commercial and industrial companies.

One of the people I most respect in the industry gave me the following example of just how harmful these types of exploits could prove to be. Those who know their Star Wars history will recall that then-Chancellor Palpatine used a similar technique to become Emperor. His infamous Order 66 was implanted into the clone army and, at the right moment, they slaughtered their Jedi leaders. Blood flowed red and deep that day, and it became known as The Great Jedi Purge.

(I would hyperlink all of these little factoids, but I can’t stand even to copy and paste the wiki links to this crap. As for my pal, he’s not a Star Wars geek – but he is the father of two boys who watched the movies enough to wear out the DVDs, so he picked up the story via osmosis.)

In conclusion: we need to be concerned about the safety of high tech supply chains and wary of vendors. And ambitious chancellors… and clone programming too, I guess. As for me, I’m off to see if I can get Norton to run on our new microwave.

Boost IT visibility and business value

More from The Register

next story
Pay to play: The hidden cost of software defined everything
Enter credit card details if you want that system you bought to actually be useful
Shoot-em-up: Sony Online Entertainment hit by 'large scale DDoS attack'
Games disrupted as firm struggles to control network
HP busts out new ProLiant Gen9 servers
Think those are cool? Wait till you get a load of our racks
Silicon Valley jolted by magnitude 6.1 quake – its biggest in 25 years
Did the earth move for you at VMworld – oh, OK. It just did. A lot
VMware's high-wire balancing act: EVO might drag us ALL down
Get it right, EMC, or there'll be STORAGE CIVIL WAR. Mark my words
Forrester says it's time to give up on physical storage arrays
The physical/virtual storage tipping point may just have arrived
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.